Google Chrome CVE-2026-78899

The victim must navigate to a crafted HTML page using an affected version of Google Chrome (prior to 152.0.7977.65) - this is the sole triggering condition (UI:R in CVSS). No authentication, privileged account, special server-side configuration, or non-default browser setting is required; standard out-of-the-box Chrome installations are vulnerable. The CVSS PR:N metric confirms exploitation requires no attacker-controlled credentials or pre-existing session. Exploitation is strictly bounded to code execution within the Chrome renderer sandbox: a successful exploit does not automatically grant host OS-level access without a separate, chained sandbox escape vulnerability. On Linux hosts running Chrome with seccomp-bpf filtering, post-exploitation syscall access is further constrained. The non-automatable SSVC flag indicates that without user interaction the attack cannot proceed at scale.

The CVSS 8.8 vector reflects a high-severity, network-accessible flaw requiring no attacker authentication and only passive user interaction (visiting a page), with full confidentiality, integrity, and availability impact within the unchanged scope (S:U). SSVC signals diverge meaningfully: exploitation status is 'none', the attack is not automatable (no silent drive-by without UI:R), and while technical impact is 'total', the sandbox boundary substantially limits real-world blast radius. EPSS at 0.46% (38th percentile) places this well below the median exploitation probability for similarly scored CVEs. No CISA KEV entry exists. The overall picture is a high-potential but currently unrealized threat - prioritization should be high for managed endpoints on slow update cycles and for organizations where a renderer compromise chained with a sandbox escape would meet threat model thresholds, but this is not an immediate mass-exploitation emergency based on available signals.

An attacker hosts a malicious webpage containing crafted JavaScript that triggers the use-after-free condition in Chrome's V8 engine. When a target user is directed to the page - via phishing link, malvertising, or a compromised legitimate site - Chrome processes the JavaScript and the resulting memory corruption grants the attacker code execution within the Chrome renderer sandbox. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests that once the memory corruption primitive is established, reliable exploitation is achievable by a skilled attacker.